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new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
O) Yes 

©) No 

© Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


| appreciate that the GDPR does not set out formal requirements for a valid request, but some further 
guidance regarding what could be considered a valid request where there is a dispute about whether a 
request was actually made and what evidence would be required would be useful. Guidance about 
disclosing information that would be considered business sensitive (that does not fit one of the 
exemptions) is needed. This is particularly relevant to financial services where customers use SARs as a 
way of finding out confidential information relating to pricing for insurance purposes. Further guidance is 
needed in relation to the crime and taxation exemption in the instance where a fraudulent application is 
made and the victim makes a SAR or the person attempting to commit fraud. 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Further detail taking into account the wider body of law, such as requests that are motivated by obtaining 
information for litigation would be useful for a more rounded view on how to respond to requests. 


Q3 


Does the draft guidance contain enough examples? 
-) Yes 


© No 


©) Unsure / don't know 
If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


| would like to see some examples where the ICO would consider the disclosure of third party information 
to be reasonable. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


A customer suspected of insurance fraud making numerous legal threats aimed at 
particular individuals with the company repeatedly asking for information to be 


provided to them with a view to finding out how potential fraudulent applications are 
analysed. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


Moderately 
useful 


1-Notatall 2 - Slightly 4 — Very 
useful useful 


useful 


© ©) 


5 — Extremely 
useful 


Q6 


Why have you given this score? 


It is very useful as a basis for understanding the law. If the guidance is aimed at 
privacy professionals going further and including examples of case law that is 


applicable or ICO decisions would aid understanding and enable better explanations 
to individuals. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 
Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


As above, further examples and ICO decisions would improve the guidance. 


Are you answering as: 


O An individual acting in a private capacity (eg someone providing their views as a member of the public) 
C) An individual acting in a professional capacity 

© On behalf of an organisation 

( ) Other 

Please specify the name of your organisation: 

Saga Group 


What sector are you from: 
Insurance/Travel 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(|) ICO Facebook account 
©) ICO LinkedIn account 
© ICO website 
©) ICO newsletter 
C) ICO staff member 
C) Colleague 
©) Personal/work Twitter account 
(`) Personal/work Facebook account 
() Personal/work LinkedIn account 
O Other 
If other please specify: 


